> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linquid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure Workspace Access (SSO, 2FA, API Keys)

> Harden workspace access and rotate credentials safely

# Secure Workspace Access (SSO, 2FA, API Keys)

## Baseline controls

1. Enforce strong account authentication and 2FA.
2. Configure SSO/SAML if your plan requires centralized identity.
3. Rotate API keys and webhook secrets on a schedule.
4. Remove stale members and inactive invites.

## API key operations

* Create keys only for required integrations.
* Store once in secret manager.
* Scope usage to required automation only.
* Rotate immediately on exposure suspicion.

## Security review cadence

* Weekly: member and invite review.
* Monthly: key rotation audit.
* Quarterly: role and SSO policy review.

## Related

* `/user-guides/manual/workspace/security-and-compliance`
* `/user-guides/manual/workspace/api-access-and-scopes`